9. Glossary and Cheatsheet

The ten-second lookup: every term in one line, the commands you'll actually type, the resource ID shape, and the limits worth knowing.

Glossary

AAD Pod Identity — retired. The old way of giving pods an Azure identity. Replaced by Microsoft Entra Workload ID. If a guide mentions AzureIdentity CRDs, it predates the replacement.

Add-on — a first-party component AKS installs and upgrades for you: Container Insights, Azure Policy, KEDA, App Routing, the Key Vault Secrets Store CSI driver, workload identity, the Istio-based service mesh, virtual nodes.

Admission controller — code that inspects (and may mutate or reject) an object after authorization but before it's persisted to etcd. Where the Azure Policy add-on's Gatekeeper constraints run.

Agent pool — the ARM name for a node pool. Microsoft.ContainerService/managedClusters/agentPools.

AKS Automatic — a cluster mode where Azure preconfigures node autoprovisioning, monitoring, Entra integration, network policy, and other production defaults, and pins the Standard tier. Fewer knobs, better baseline.

API server — the only component of the Kubernetes control plane anything talks to. Managed by Microsoft; reachable at <cluster>.hcp.<region>.azmk8s.io, or privately.

App Routing — the managed NGINX ingress controller add-on, with optional Key Vault certificate integration.

Application Gateway for Containers — Azure's L7 load balancer driven by the ALB controller via Gateway API. Successor to AGIC (Application Gateway Ingress Controller).

Availability zone — a physically separate datacentre within a region. Node pools opt into zones; managed disks are pinned to one. See regions and availability.

Azure CNI Overlay — the recommended network plugin mode: nodes get VNet IPs, pods get IPs from a private overlay CIDR. Scales without consuming VNet address space.

Azure CNI (node subnet) — every pod gets a real VNet IP from the node subnet. Directly addressable pods, at the cost of max_pods × nodes addresses.

Azure Linux — Microsoft's own container-host Linux distribution, formerly CBL-Mariner. A node os_sku option alongside Ubuntu and Windows Server.

Azure Policy add-on — Gatekeeper, wired to Azure Policy, enforcing constraints at admission inside the cluster.

Azure RBAC for Kubernetes Authorization — a mode where Azure role assignments (RBAC Reader / Writer / Admin / Cluster Admin) authorize in-cluster actions instead of Kubernetes RoleBindings.

Cluster autoscaler — adds nodes to an existing pool when pods are Pending, removes them when underused. Bounded by the pool's min/max. Cannot invent a larger VM size.

Cluster identity — the managed identity the cluster's Azure controllers use to create load balancers, attach disks, and read the VNet. Distinct from the kubelet identity.

Cluster extension — an ARM-managed component installed into the cluster (Flux, Dapr), as opposed to something you helm install yourself.

Container Insights — the Azure Monitor add-on that ships container logs and inventory to a Log Analytics workspace. The usual source of surprise log bills.

containerd — the container runtime AKS nodes use. Docker-as-runtime has been gone for several Kubernetes versions.

CoreDNS — in-cluster DNS, running as a Deployment in kube-system. Under-provisioning it produces tail-latency mysteries.

CSI driver — the Container Storage Interface plugin that turns a PersistentVolumeClaim into a real Azure resource: managed disk, Azure Files share, or Blob mount.

DaemonSet — one pod per (matching) node. How agents, log collectors, and CSI node plugins run.

Deployment — the standard controller for stateless workloads: manages ReplicaSets to give declarative rolling updates and rollbacks.

Drain — evict a node's pods, respecting PodDisruptionBudgets, so the node can be removed or replaced. Step two of every node upgrade.

Federated identity credential — the trust configuration on a managed identity that accepts tokens from the cluster's OIDC issuer for a specific system:serviceaccount:<ns>:<name>.

Flux — the GitOps operator available as an AKS cluster extension, reconciling cluster state from a Git repository.

Fleet Manager — multi-cluster configuration propagation and upgrade coordination across AKS clusters.

Free / Standard / Premium — the cluster sku_tier. Free has no SLA; Standard adds the API server SLA; Premium adds Long-Term Support.

Gatekeeper — the OPA-based admission controller underneath the Azure Policy add-on.

HorizontalPodAutoscaler (HPA) — scales the number of pod replicas on metrics.

Ingress — HTTP(S) routing into the cluster. Increasingly expressed via the Gateway API.

KEDA — the event-driven autoscaler add-on. Drives the HPA from queue depth, topic lag, and dozens of other sources, and can scale to zero replicas.

kubelet — the per-node agent that starts containers, reports node status, and mounts volumes.

kubelet identity — the managed identity nodes use to pull images. This is what gets AcrPull. Granting it anything else gives every pod on every node that access.

kubelogin — the credential plugin kubectl uses to obtain Entra ID tokens for an Entra-integrated cluster.

kubenet — the legacy network plugin. Retiring 31 March 2028; migrate to Azure CNI Overlay.

kube-proxy — programs each node's iptables/IPVS rules so Service ClusterIPs reach pod IPs. Replaced by eBPF when using Cilium.

Konnectivity — the outbound tunnel from nodes to the managed control plane. Successor to tunnelfront / aks-link.

Local accounts — the certificate-based cluster-admin kubeconfig, which bypasses Entra ID and Kubernetes RBAC. Disable it in production (--disable-local-accounts).

Long-Term Support (LTS) — Premium-tier extended support for a designated Kubernetes version, roughly two years ⚠️ verify current policy.

Managed cluster — the ARM resource: Microsoft.ContainerService/managedClusters.

max_pods — the pod-slot ceiling per node in a pool. Set at pool creation, immutable, and with node-subnet CNI it also determines VNet IP consumption.

max_surge — how many extra nodes an upgrade may add at once. Trades upgrade speed against transient capacity cost.

Microsoft Entra ID — formerly Azure Active Directory. The tenant-level identity provider. See identity and RBAC.

Microsoft Entra Workload ID — a Kubernetes ServiceAccount federated to a user-assigned managed identity, so a pod authenticates to Azure with no secret. AWS's IRSA, near-equivalently.

Namespace — a soft naming and isolation boundary inside the cluster. Not a security boundary without network policy, RBAC, and quotas.

NAT Gateway — an outbound_type giving vastly more SNAT ports and a longer idle timeout than the default load-balancer SNAT. The standard fix for SNAT port exhaustion.

Network policy — in-cluster firewall rules between pods (azure, calico, or Cilium). Off by default; without it every pod can reach every other pod.

Node autoprovisioning (NAP) — creates right-sized node pools on demand, based on Karpenter. Removes the need to guess VM sizes up front ⚠️ verify current availability and preview status.

Node image upgrade — patches the node OS without changing the Kubernetes version. More frequent than a version upgrade and equally necessary.

Node resource group (MC_*) — the AKS-owned resource group in your subscription holding the scale sets, disks, load balancer, and public IPs. Don't lock it, don't hand-edit it.

OIDC issuer — the cluster's public token-discovery endpoint. Prerequisite for workload identity.

only_critical_addons_enabled — taints the system node pool so only system workloads land on it.

Outbound type — how pods reach the internet: loadBalancer (default), managedNATGateway, userAssignedNATGateway, or userDefinedRouting (through a firewall).

PersistentVolumeClaim (PVC) — a request for storage. Becomes an Azure managed disk, Files share, or Blob mount via a CSI driver.

Pod — the smallest schedulable unit: one or more containers sharing a network namespace, IP, and volumes. Ephemeral by design.

PodDisruptionBudget (PDB) — constrains how many pods a voluntary disruption may remove. Unsatisfiable PDBs are the top cause of hung upgrades.

Private cluster — API server reachable only via Private Link. Solves an exposure problem; creates a build-agent and DNS problem.

Reclaim policy — what happens to the backing Azure resource when a PVC is deleted: Delete (gone, and so is your data) or Retain (kept, and still billing).

Requests / limits — what the scheduler guarantees and bin-packs against, versus what the kernel enforces. Wrong requests break scheduling, autoscaling, and cost simultaneously.

Service (Kubernetes) — a stable virtual IP and DNS name front-ending a set of pods. Type LoadBalancer provisions a real Azure load-balancer rule and public IP.

Service CIDR / pod CIDR / DNS service IP — three address ranges that must not overlap each other, the VNet, or anything peered.

SNAT port exhaustion — running out of source ports for outbound connections, producing intermittent timeouts that look like a DNS or application fault. Fixed with a NAT Gateway.

Spot node pool — heavily discounted, evictable capacity. Use a taint and toleration so only opted-in workloads land there.

StatefulSet — pods with stable identities and stable per-pod storage.

System node pool — the mandatory Linux pool hosting CoreDNS, the metrics server, and other critical system pods. Cannot scale to zero.

temporary_name_for_rotation — the Terraform argument that lets the provider rotate the default node pool in place instead of replacing the whole cluster.

Virtual nodes — a virtual-kubelet integration scheduling pods onto Azure Container Instances instead of real nodes. Burst capacity with real limitations.

Workload identity — see Microsoft Entra Workload ID.

Cheatsheet

# --- Cluster lifecycle ----------------------------------------------------
az aks create -g rg-app -n aks-app --tier standard --node-count 3 \
  --network-plugin azure --network-plugin-mode overlay \
  --enable-managed-identity --enable-oidc-issuer --enable-workload-identity \
  --enable-aad --enable-azure-rbac --disable-local-accounts \
  --zones 1 2 3 --generate-ssh-keys

az aks get-credentials -g rg-app -n aks-app          # merge kubeconfig
az aks get-credentials -g rg-app -n aks-app --admin  # break-glass; fails if local accounts disabled
az aks show    -g rg-app -n aks-app -o table
az aks list --query "[].{n:name, v:kubernetesVersion, tier:sku.tier}" -o table
az aks update  -g rg-app -n aks-app                  # no-op update forces a reconcile — clears many Failed states
az aks delete  -g rg-app -n aks-app --yes

# --- Node pools -----------------------------------------------------------
az aks nodepool list -g rg-app --cluster-name aks-app -o table
az aks nodepool add  -g rg-app --cluster-name aks-app -n gpu \
  --node-vm-size Standard_NC6s_v3 --node-count 1 --node-taints sku=gpu:NoSchedule
az aks nodepool scale -g rg-app --cluster-name aks-app -n apps --node-count 5
az aks nodepool delete -g rg-app --cluster-name aks-app -n gpu

# --- Upgrades -------------------------------------------------------------
az aks get-upgrades -g rg-app -n aks-app -o table
az aks upgrade      -g rg-app -n aks-app --kubernetes-version 1.31.3
az aks upgrade      -g rg-app -n aks-app --node-image-only    # OS patches, same k8s version
az aks nodepool upgrade -g rg-app --cluster-name aks-app -n apps --node-image-only

# --- Registry, monitoring, and running commands on a private cluster ------
az aks update -g rg-app -n aks-app --attach-acr acrapp
az aks enable-addons -g rg-app -n aks-app -a monitoring --workspace-resource-id <workspace-id>
az aks command invoke -g rg-app -n aks-app --command "kubectl get pods -A"

# --- The node resource group: look, don't touch ---------------------------
az aks show -g rg-app -n aks-app --query nodeResourceGroup -o tsv
az resource list -g $(az aks show -g rg-app -n aks-app --query nodeResourceGroup -o tsv) -o table

# --- kubectl: the twenty commands that cover most days --------------------
kubectl get nodes -o wide
kubectl get pods -A -o wide
kubectl get pods --field-selector=status.phase!=Running -A     # everything unhealthy
kubectl describe pod <pod> -n <ns>                             # events explain failures
kubectl logs <pod> -n <ns> --previous                          # the crash you actually care about
kubectl top nodes ; kubectl top pods -n <ns>                   # needs the metrics server

kubectl rollout status  deployment/<name> -n <ns>
kubectl rollout undo    deployment/<name> -n <ns>
kubectl rollout restart deployment/<name> -n <ns>

kubectl get events -A --sort-by=.lastTimestamp | tail -40
kubectl get pdb -A                                             # hunt unsatisfiable budgets
kubectl cordon <node> ; kubectl drain <node> --ignore-daemonsets --delete-emptydir-data
kubectl uncordon <node>
kubectl auth can-i create deployments -n <ns>                   # RBAC, answered directly
kubectl diff -f manifests/                                      # live cluster vs. your manifests
kubectl api-resources | grep <thing>                            # what CRDs exist here

Resource ID shapes

# The cluster
/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.ContainerService/managedClusters/{cluster}

# A node pool
/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.ContainerService/managedClusters/{cluster}/agentPools/{pool}

# A namespace-scoped Azure RBAC assignment (Azure RBAC for Kubernetes Authorization)
/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.ContainerService/managedClusters/{cluster}/namespaces/{namespace}

That last shape is the one worth memorising: it's how you grant a team writer access to one namespace and nothing else, using an Azure role assignment.

Limits worth knowing — with their scopes

A number without a scope is useless in Azure, and AKS quotas vary by region, subscription type, and tier. Treat every figure below as a shape to reason about, not a fact to quote.

Limit	Counted at	Notes
vCPU quota per VM family	Subscription, per region	The limit that actually blocks scaling. az vm list-usage -l <region>. Raise via Azure Quota before you need it ⚠️ verify current defaults
Nodes per cluster	Per cluster	Higher on Standard/Premium than Free ⚠️ verify current numbers
Node pools per cluster	Per cluster	⚠️ verify
Pods per node	Per node pool	Set at pool creation, immutable. Defaults differ between CNI modes
Pods per cluster	Per cluster	Effectively nodes × max_pods, capped ⚠️ verify
Clusters per subscription	Per subscription, per region	⚠️ verify
SNAT ports	Per outbound public IP, divided among nodes	Not a raisable quota — change the outbound type to NAT Gateway
Load balancer rules, public IPs	Subscription, per region	Every LoadBalancer Service consumes some
Kubernetes version support window	Per version	Roughly one year; ~N-2 supported at any time; Premium LTS roughly two years ⚠️ verify the current support policy — this is the number that dates fastest

The five things to remember if you remember nothing else

1. There are two resource groups, and the MC_* one is AKS's. Don't lock it, don't edit it.
2. Three authorization layers stack — Azure RBAC on the resource, Kubernetes RBAC inside, and the cluster-admin credential that bypasses both. Disable local accounts.
3. The network plugin is chosen once. Changing it means a new cluster.
4. Nodes bill whether or not pods run on them. Right-sizing requests is the biggest cost lever on any cluster.
5. Upgrades are the job. Roughly a year of support per Kubernetes version, and every upgrade rolls every node — which means every upgrade tests your disruption budgets and probes.

---

← Back to the Azure Kubernetes Service overview · ← Previous: Interview Questions